View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0007962OXID eShop (all versions)2.3. Extensions (modules, themes)public2026-06-11 15:402026-06-11 15:40
ReporterNilsBaczynski Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status newResolutionopen 
Product Version6.5.4 
Summary0007962: PayPal Checkout ignores paymentId when basket already contains another payment method
DescriptionWhen using PayPal Checkout, the PayPal module passes the correct payment ID oscpaypal to the shop order creation process. However, if the basket already contains another payment method, for example oxidamazon, the PayPal payment ID is ignored and the order is created with the previously stored basket payment method.

Relevant code path:
```
// vendor/oxid-solution-catalysts/paypal-module/src/Controller/AjaxPaymentController.php:109

$paymentId = $data['paymentId'] ?? null;

$this->orderManager->createShopOrder($paymentId);
```

Inside createShopOrder(), the PayPal payment method is only set if the basket currently has no payment method assigned:

```
// vendor/oxid-solution-catalysts/paypal-module/src/Service/OrderManager.php:75

if (empty($this->basket->getPaymentId()) && !empty($paymentId)) {
    $this->basket->setPayment($paymentId);
}
```

If the basket already contains oxidamazon, the provided PayPal payment ID is ignored.

The OXID order then uses the payment method directly from the basket:

```
// vendor/oxid-esales/oxideshop-ce/source/Application/Model/Order.php:515

$oUserPayment = $this->_setPayment($oBasket->getPaymentId());
```

As a result, the created order contains:

```
OXPAYMENTTYPE = oxidamazon
```

although the customer actually completed the checkout using PayPal.

At the same time, the PayPal Checkout flow sets a special session flag:

```
// vendor/oxid-solution-catalysts/paypal-module/src/Service/OrderManager.php:82

$session->setVariable('isPayPalPaymentCheckout', true);
```

This flag causes the regular payment execution to be skipped:

```
// vendor/oxid-solution-catalysts/paypal-module/src/Model/Order.php:413

if (Registry::getSession()->getVariable('isPayPalPaymentCheckout')) {
    return true;
}
```

OXID interprets this true return value as a successful payment and sets the order status to OK:

```
// vendor/oxid-esales/oxideshop-ce/source/Application/Model/Order.php:552

$this->_setOrderStatus('OK');
```

Only after the OXID order has already been created, the PayPal module changes the basket payment method to PayPal:

```
// vendor/oxid-solution-catalysts/paypal-module/src/Controller/AjaxPaymentController.php:130

$this->setPayPalPaymentMethod(
    PayPalDefinitions::STANDARD_PAYPAL_PAYMENT_ID
);
```

This happens too late for the already created OXID order.

Expected behavior:

When PayPal Checkout is used, the order should be created with the PayPal payment method, for example:

`OXPAYMENTTYPE = oscpaypal`

The PayPal payment ID passed to createShopOrder($paymentId) should overwrite any previously stored basket payment method for this checkout flow.

Actual behavior:

If the basket already contains another payment method, for example oxidamazon, the order is created with: `OXPAYMENTTYPE = oxidamazon`

even though the customer used PayPal Checkout. The order is then marked as OK because the PayPal Checkout session flag skips the normal payment execution.

Possible fix:

In the PayPal Checkout flow, createShopOrder($paymentId) should set the provided payment ID whenever it is present, not only when the basket payment ID is empty.

Current logic:

```
if (empty($this->basket->getPaymentId()) && !empty($paymentId)) {
    $this->basket->setPayment($paymentId);
}
```
Possible adjusted logic:

```
if (!empty($paymentId)) {
    $this->basket->setPayment($paymentId);
}
```

This would ensure that the order is created with the payment method actually used in the checkout.
Steps To ReproduceSteps to reproduce:

1. Install and activate the OXID PayPal module.

2. Configure PayPal Checkout / PayPal payment so that `oscpaypal` is available as a payment method.

3. Add a product to the basket.

4. Select a different payment method first, for example Amazon Pay, so that the basket contains:

   OXPAYMENTTYPE / paymentId = oxidamazon

5. Without clearing the basket or resetting the selected payment method, start the PayPal Checkout flow.

6. Complete the PayPal Checkout.

7. Let the PayPal module create the OXID order via:

   vendor/oxid-solution-catalysts/paypal-module/src/Controller/AjaxPaymentController.php

   $paymentId = $data['paymentId'] ?? null;
   $this->orderManager->createShopOrder($paymentId);

8. Check the created order in the database, for example in table `oxorder`.

9. Inspect the value of `OXPAYMENTTYPE` for the created order.

Expected result:

The order should be created with the PayPal payment method:

   OXPAYMENTTYPE = oscpaypal

Actual result:

The order is created with the previously selected basket payment method:

   OXPAYMENTTYPE = oxidamazon

although the customer completed the checkout using PayPal.

Additional observation:

The PayPal Checkout flow sets the session flag:

   isPayPalPaymentCheckout = true
Additional InformationThis was reproduced only with amazon pay, Problems with other payments are not confirmed.
TagsModule, Payment, PayPal
ThemeNot defined
BrowserNot defined
PHP VersionAll
Database VersionNot defined

Activities

There are no notes attached to this issue.